Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plausible Analytics Isn't GDPR Compliant

blog.paranoidpenguin.net

Post reply on HN
Print view View original

51–60 of 80 posts

Re: Plausible Analytics Isn't GDPR Compliant

#51

Post by donohoe »

corentin88 wrote: post #25
donohoe wrote: post #17

Plausible Analytics is GDPR compliant - with one possible exception - the IP address which if they dropped the last 3 digits would probably be enough. The blog post conflates general data points with PII. The IP address is considered PII. While other info can be used for fingerprinting, it’s ok to use in some capacity as long as you don’t. For background, I’ve done GDPR implantation a in the past, an a privacy advoca…

GDPR states “For data to be truly anonymised, the anonymisation must be irreversible”. So dropping 3 digits is clearly not enough to anonymize PII, it’s more pseudonymization.

True. I was thinking more about how it drops some location level information.

I can't presume what Plausible does (have not read their docs in awhile) but they have commented here to provide more specific clarification that address IP usage (TLDR: what they do is fine and compliant)

Re: Plausible Analytics Isn't GDPR Compliant

#52

Post by donohoe »

that_guy_iain wrote: post #45
corentin88 wrote: post #25

Earlier quoted context omitted.

GDPR states “For data to be truly anonymised, the anonymisation must be irreversible”. So dropping 3 digits is clearly not enough to anonymize PII, it’s more pseudonymization.

I am curious, how are you going to unanonymise an IP to something that could have 255 combinations (and that's just if you drop that last part on an IPv4). Nevermind that an IP alone is not PII. How can you reverse something that has many possibilties?

>> IP alone is not PII

It is in Europe, despite some regional rulings (Germany?). It is not considered PII in the USA.

Re: Plausible Analytics Isn't GDPR Compliant

#53

Post by fogihujy »

nscmnto wrote: post #38
donohoe wrote: post #17

Plausible Analytics is GDPR compliant - with one possible exception - the IP address which if they dropped the last 3 digits would probably be enough. The blog post conflates general data points with PII. The IP address is considered PII. While other info can be used for fingerprinting, it’s ok to use in some capacity as long as you don’t. For background, I’ve done GDPR implantation a in the past, an a privacy advoca…

The IP address, on its own, should not considered PII. There was a ruling in Breyer vs. Germany that IP addresses can be considered PII – in certain circumstances. The case was brought against an ISP, and the court ruled that the company had enough correlating data at its disposal to make an IP address de facto PII for any of its customers. The court limited its ruling, saying that with just an IP address alone, the…

GDPR simply classifies "personal data" as any piece of information that can be used to identify an individual. A static IP used by one person could therefore be considered personal data while a public IP shared between thousands of people behind carrier-grade NAT would not.

The problem is that you can't tell the two apart and decide when it's safe handle the IP.

Re: Plausible Analytics Isn't GDPR Compliant

#54

Post by donohoe »

Nextgrid wrote: post #15
_the_special_ wrote: post #14

doesn't the GDPR protect against storing "Personally identifiable information"? Plausible does use the IP address for the visitor to create a unique visitor ID, but it does not store it, so I am not sure how can you use that information to link it to an individual.

If the algorithm for turning an IP address into a visitor ID is reversible then that ID is equivalent to the IP address as far as the GDPR is concerned.

The point to note here is "if". Happily, they (Plausible) don't.

Re: Plausible Analytics Isn't GDPR Compliant

#55

Post by yorwba »

nscmnto wrote: post #38
donohoe wrote: post #17

Plausible Analytics is GDPR compliant - with one possible exception - the IP address which if they dropped the last 3 digits would probably be enough. The blog post conflates general data points with PII. The IP address is considered PII. While other info can be used for fingerprinting, it’s ok to use in some capacity as long as you don’t. For background, I’ve done GDPR implantation a in the past, an a privacy advoca…

The IP address, on its own, should not considered PII. There was a ruling in Breyer vs. Germany that IP addresses can be considered PII – in certain circumstances. The case was brought against an ISP, and the court ruled that the company had enough correlating data at its disposal to make an IP address de facto PII for any of its customers. The court limited its ruling, saying that with just an IP address alone, the…

IP addresses IP addresses are never PII. PII means information about a person who can be identified. In that context, IP adresses are an identifier, not the information itself.

If you store IP adresses in your customer database, the information is that a person with that IP is one of your customers. This information is considered PII if it's possible to use the IP to identify the person the information is about, e.g. using a government database of everyone's IP address. If the data never reaches someone with access to such a database, it's not PII.

(This is a somewhat pendantic distinction, but it matters legally. Data protection law doesn't care about which identifiers are being used, but about the data associated with it and whether it tells you something about a specific identifiable person.)

Re: Plausible Analytics Isn't GDPR Compliant

#56

Post by dbbk »

corentin88 wrote: post #25
donohoe wrote: post #17

Plausible Analytics is GDPR compliant - with one possible exception - the IP address which if they dropped the last 3 digits would probably be enough. The blog post conflates general data points with PII. The IP address is considered PII. While other info can be used for fingerprinting, it’s ok to use in some capacity as long as you don’t. For background, I’ve done GDPR implantation a in the past, an a privacy advoca…

GDPR states “For data to be truly anonymised, the anonymisation must be irreversible”. So dropping 3 digits is clearly not enough to anonymize PII, it’s more pseudonymization.

How can an IP address without the last 3 digits possibly ever identify someone? That surface area is just way too large.

Re: Plausible Analytics Isn't GDPR Compliant

#57

Post by dbbk »

Nextgrid wrote: post #15
_the_special_ wrote: post #14

doesn't the GDPR protect against storing "Personally identifiable information"? Plausible does use the IP address for the visitor to create a unique visitor ID, but it does not store it, so I am not sure how can you use that information to link it to an individual.

If the algorithm for turning an IP address into a visitor ID is reversible then that ID is equivalent to the IP address as far as the GDPR is concerned.

It's not reversible, it's hashed with a daily salt.

Re: Plausible Analytics Isn't GDPR Compliant

#58

Post by donohoe »

ramboram wrote: post #2

I've been looking into GDPR and when a cookie consent is needed. In fact, there's no thing called "cookie consent". If you track a user, you have to get his consent before doing it, whether you use cookie consent or now. Ever since I joined HN, there's a lot of marketing going on here from privacy-first Google analytics alternative guys. I found this review showing Plausible and similar products using browser fingerp…

Not a lawyer, but you do not need a consent banner with their services.

This is as much about what information is available AND what you do with it. Browsers send information whether you ask/use it or not.

At a high-level (and not necessarily speaking about Plausible here cos I don't know the inner workings), it is ok for a service to use personal information (looking at the IP address here) if in a form that is not traceable back to a user, and not used for tracking individuals.

In this case the use of CNAME is fine, its just to stop the blunt blocking of JS etc that happens as a reaction. Its worth noting that GDPR does permit data collection for essential services and (there is some dispute/debate on this) basic site analytics can be considered essential services.

In regards to Plausible, they are commenting directly here and seem to be address all these concerns.

IMHO the blog post author sees a problem at the surface level but is not an expert - but for those of us more familiar with the legal framework behind this, the exceptions, and the distinctions of how information is used (and supporters of GDPR), what Plausible doing is good and compliant.

(To be clear; I'm not affiliated with them - am just supportive of GDPR friendly alternatives like this one)

Re: Plausible Analytics Isn't GDPR Compliant

#59

Post by cuu508 »

lez wrote: post #46

I have the feeling that GDPR and Cookie consent laws themselves, ironically, make harder for the services to provide privacy.

How so?

Storing a "user has opted out from tracking cookies" binary flag in a cookie is not the same as storing an unique identifier in a cookie.

Re: Plausible Analytics Isn't GDPR Compliant

#60

Post by KingOfCoders »

a.) The term "GDPR Compliant" does not exist. All software can be "GDPR Compliant" and still do fingerprinting it there is consent or necessities (hard to do). What they mean is that you do not need to get consent from your users to use Plausible.

b.) They don't store IP addresses. Information they gather are not stored in a way to build user profiles or do fingerprinting.

It doesn't look like the articles author took a look a the Plausible documentation or source code.

Post reply on HN